FTD IKEv2 to Windows 10 Native client with dynamic Group Policies

[TomasGahura2939]

Dear all,

lately I have managed to make FTD to support IKEv2 tunnel from Windows 10 Native client, using only certificate authentication.

However the configuration is working only with one locally created address-pool.

For SSL we have 3 different Group Policies assigned based on the username input in Anyconnect login. AD will than assign correct group policy for that VPN user.

Is there a way how to configure IKEv2 to extract username from certificate, verify than username on AD and send correct group policy same as SSL VPN?

Thank you for any suggestions.

[Nicolai Borchorst · Accepted solution]

I don't belive this is possible on FTD, but might be possible using ISE for authentication and authorization. You cannot use EAP-TLS for authenticating Anyconnect SSL Sessions with ISE, but a combination of the discussions in below links could provide useful info. 

https://community.cisco.com/t5/network-access-control/vpn-certificate-auth-using-ise/td-p/3513185

https://www.petenetlive.com/KB/Article/0001155 

[TomasGahura2939]

Nicolai thank you so much!

I was missing out the authorization part of the request, since authentication happened only on FTD box (which only authenticated the client certificate).

For anyone wondering, I have managed to make working config for Win 10 native IKEv2 "always on" VPN tunnel. FTD will extrace the UPN from certificate and ISE will assign the correct group policy for each user.

tunnel-group DefaultRAGroup general-attributes
authorization-server-group ISE_RADIUS
authorization-required
username-from-certificate UPN
tunnel-group DefaultRAGroup ipsec-attributes
peer-id-validate cert
ikev2 rsa-sig-hash sha1
ikev2 remote-authentication certificate
ikev2 local-authentication certificate cert_tp

Thank you!